Hi there,

I try to create a Powershell AuditLog Search which finds me all labeled documents deleted by a specific person. 

After a person has been dismissed, the aim is to find the sensitive documents that this person deleted shortly beforehand.

My script has no output at all and in the moment I am clueless what the reason could be. I made it simpler than my acutal question is:

$daysAgo = 30; $startDate = (Get-Date).AddDays(-$daysAgo)
$results = Search-UnifiedAuditLog -StartDate $startDate -EndDate (Get-Date) -RecordType SharePoint -Operations FileDeleted -ResultSize 5000 |
Where-Object {
$_.CreationTime -gt $startDate
} |
Select-Object CreationTime, UserIds, Operations, AuditData

$results | Export-Csv -Path “PATH.csv” -NoTypeInformation

Does anybody see my error? Thanks in advance :crossed_fingers:

​Hi there, I try to create a Powershell AuditLog Search which finds me all labeled documents deleted by a specific person. After a person has been dismissed, the aim is to find the sensitive documents that this person deleted shortly beforehand. My script has no output at all and in the moment I am clueless what the reason could be. I made it simpler than my acutal question is: $daysAgo = 30; $startDate = (Get-Date).AddDays(-$daysAgo)$results = Search-UnifiedAuditLog -StartDate $startDate -EndDate (Get-Date) -RecordType SharePoint -Operations FileDeleted -ResultSize 5000 |Where-Object {$_.CreationTime -gt $startDate} |Select-Object CreationTime, UserIds, Operations, AuditData$results | Export-Csv -Path “PATH.csv” -NoTypeInformation  Does anybody see my error? Thanks in advance :crossed_fingers:  Read More

​